{"affected":[{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p68j-q7hf-3qcp/GHSA-p68j-q7hf-3qcp.json"},"package":{"ecosystem":"Maven","name":"io.spinnaker.rosco:rosco-manifests","purl":"pkg:maven/io.spinnaker.rosco/rosco-manifests"},"ranges":[{"events":[{"introduced":"0"},{"fixed":"2025.3.4"}],"type":"ECOSYSTEM"}],"versions":["1.10.0","1.11.0","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.13.0","1.13.1","1.13.2","1.13.3","1.13.4","1.14.0","1.15.0","1.16.0","1.17.0","1.17.1","1.17.2","1.18.0","1.18.1","1.18.2","1.19.0","1.19.1","1.20.0","1.20.1","1.20.2","1.20.3","1.21.0","1.21.1","1.22.0","1.22.1","1.22.2","1.23.0","1.23.1","1.24.0","1.25.0","1.26.0","1.7.2","1.7.3","1.7.4","1.7.5","1.7.6","1.7.7","1.7.8","1.8.0","1.8.0-rc.1","1.8.0-rc.10","1.8.0-rc.11","1.8.0-rc.12","1.8.0-rc.2","1.8.0-rc.3","1.8.0-rc.4","1.8.0-rc.5","1.8.0-rc.6","1.8.0-rc.7","1.8.0-rc.8","1.8.0-rc.9","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.9.0","2025.0-0","2025.0-1","2025.0-10","2025.0-11","2025.0-12","2025.0-13","2025.0-14","2025.0-15","2025.0-16","2025.0-17","2025.0-18","2025.0-19","2025.0-2","2025.0-20","2025.0-21","2025.0-22","2025.0-23","2025.0-24","2025.0-25","2025.0-3","2025.0-4","2025.0-5","2025.0-6","2025.0-7","2025.0-8","2025.0-9","2025.0.0","2025.0.1","2025.0.2","2025.0.3","2025.0.4","2025.0.5","2025.0.6","2025.0.7","2025.0.8","2025.1-0","2025.1-1","2025.1-10","2025.1-11","2025.1-12","2025.1-13","2025.1-14","2025.1-15","2025.1-16","2025.1-17","2025.1-18","2025.1-19","2025.1-2","2025.1-20","2025.1-21","2025.1-22","2025.1-3","2025.1-4","2025.1-5","2025.1-6","2025.1-7","2025.1-8","2025.1-9","2025.1.0","2025.1.1","2025.1.2","2025.1.3","2025.1.4","2025.1.5","2025.1.6","2025.2-0","2025.2-1","2025.2-10","2025.2-11","2025.2-12","2025.2-13","2025.2-14","2025.2-15","2025.2-16","2025.2-2","2025.2-3","2025.2-4","2025.2-5","2025.2-6","2025.2-7","2025.2-8","2025.2-9","2025.2.0","2025.2.1","2025.2.2","2025.2.3","2025.2.4","2025.3-0","2025.3-1","2025.3-11","2025.3-12","2025.3-2","2025.3-3","2025.3-4","2025.3-5","2025.3-6","2025.3-7","2025.3-8","2025.3-9","2025.3.0","2025.3.1","2025.3.2","2025.3.3","main-10","main-100","main-101","main-102","main-103","main-104","main-105","main-107","main-108","main-109","main-11","main-110","main-111","main-112","main-113","main-114","main-115","main-116","main-117","main-118","main-119","main-12","main-120","main-121","main-122","main-123","main-124","main-125","main-126","main-127","main-128","main-129","main-13","main-130","main-131","main-132","main-133","main-134","main-135","main-136","main-137","main-138","main-139","main-14","main-140","main-141","main-142","main-143","main-144","main-145","main-146","main-147","main-148","main-149","main-15","main-150","main-151","main-152","main-153","main-154","main-155","main-156","main-157","main-158","main-159","main-16","main-160","main-161","main-162","main-163","main-164","main-165","main-166","main-167","main-168","main-169","main-17","main-170","main-171","main-172","main-173","main-174","main-175","main-176","main-177","main-178","main-179","main-18","main-180","main-181","main-182","main-183","main-184","main-185","main-186","main-187","main-188","main-189","main-19","main-190","main-191","main-192","main-193","main-194","main-195","main-196","main-197","main-198","main-199","main-20","main-200","main-201","main-202","main-203","main-204","main-205","main-206","main-207","main-208","main-209","main-21","main-210","main-211","main-212","main-213","main-214","main-215","main-216","main-217","main-218","main-219","main-22","main-220","main-221","main-222","main-223","main-224","main-225","main-226","main-227","main-228","main-229","main-23","main-230","main-231","main-232","main-233","main-234","main-235","main-236","main-237","main-239","main-24","main-241","main-272","main-273","main-274","main-275","main-276","main-277","main-278","main-279","main-280","main-281","main-282","main-283","main-284","main-285","main-286","main-287","main-288","main-289","main-290","main-291","main-292","main-293","main-294","main-295","main-296","main-297","main-298","main-299","main-30","main-300","main-301","main-302","main-303","main-304","main-305","main-306","main-307","main-308","main-309","main-31","main-310","main-311","main-312","main-313","main-314","main-315","main-316","main-317","main-318","main-319","main-32","main-320","main-321","main-322","main-323","main-324","main-325","main-326","main-327","main-328","main-329","main-33","main-330","main-331","main-332","main-333","main-334","main-335","main-336","main-337","main-34","main-35","main-36","main-37","main-38","main-39","main-40","main-41","main-42","main-43","main-44","main-45","main-46","main-47","main-48","main-49","main-5","main-50","main-51","main-52","main-53","main-54","main-55","main-56","main-57","main-58","main-59","main-6","main-60","main-61","main-62","main-63","main-64","main-65","main-66","main-67","main-68","main-69","main-7","main-70","main-71","main-72","main-73","main-74","main-75","main-76","main-77","main-78","main-79","main-8","main-80","main-81","main-84","main-85","main-86","main-87","main-88","main-89","main-9","main-90","main-91","main-92","main-93","main-94","main-95","main-96","main-97","main-98","main-99"]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p68j-q7hf-3qcp/GHSA-p68j-q7hf-3qcp.json"},"package":{"ecosystem":"Maven","name":"io.spinnaker.rosco:rosco-manifests","purl":"pkg:maven/io.spinnaker.rosco/rosco-manifests"},"ranges":[{"events":[{"introduced":"2025.4.0"},{"fixed":"2025.4.4"}],"type":"ECOSYSTEM"}],"versions":["2025.4-0","2025.4-1","2025.4-10","2025.4-11","2025.4-12","2025.4-13","2025.4-14","2025.4-15","2025.4-16","2025.4-17","2025.4-18","2025.4-19","2025.4-2","2025.4-20","2025.4-21","2025.4-3","2025.4-4","2025.4-5","2025.4-6","2025.4-7","2025.4-8","2025.4-9","2025.4.0","2025.4.1","2025.4.2","2025.4.3"]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p68j-q7hf-3qcp/GHSA-p68j-q7hf-3qcp.json"},"package":{"ecosystem":"Maven","name":"io.spinnaker.rosco:rosco-manifests","purl":"pkg:maven/io.spinnaker.rosco/rosco-manifests"},"ranges":[{"events":[{"introduced":"2026.0.0"},{"fixed":"2026.0.3"}],"type":"ECOSYSTEM"}],"versions":["2026.0-0","2026.0-1","2026.0-10","2026.0-11","2026.0-12","2026.0-13","2026.0-14","2026.0-15","2026.0-16","2026.0-17","2026.0-18","2026.0-19","2026.0-2","2026.0-20","2026.0-21","2026.0-22","2026.0-23","2026.0-3","2026.0-4","2026.0-5","2026.0-6","2026.0-7","2026.0-8","2026.0-9","2026.0.0","2026.0.1","2026.0.2"]},{"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-p68j-q7hf-3qcp/GHSA-p68j-q7hf-3qcp.json"},"package":{"ecosystem":"Maven","name":"io.spinnaker.rosco:rosco-manifests","purl":"pkg:maven/io.spinnaker.rosco/rosco-manifests"},"ranges":[{"events":[{"introduced":"2026.1.0"},{"fixed":"2026.1.1"}],"type":"ECOSYSTEM"}],"versions":["2026.1-0","2026.1-1","2026.1-10","2026.1-11","2026.1-12","2026.1-13","2026.1-14","2026.1-2","2026.1-3","2026.1-4","2026.1-5","2026.1-6","2026.1-7","2026.1-8","2026.1-9","2026.1.0"]}],"aliases":["CVE-2026-55175"],"database_specific":{"cwe_ids":["CWE-502"],"github_reviewed":true,"github_reviewed_at":"2026-08-28T18:35:06Z","nvd_published_at":"2026-07-10T23:16:48Z","severity":"HIGH"},"details":"### Impact\nKustomize bake operations allow unsafe tag processing.  This can lead to RCE type exploits on the rosco pods when doing kustomize bakes.  This ONLY is possible when using Kustomize.  The simple solution is to block kustomize operations and instead use another provider.\n\n### Workarounds\nDisable kustomize bakes","id":"GHSA-p68j-q7hf-3qcp","modified":"2026-09-10T03:51:14.688449229Z","published":"2026-08-28T18:35:06Z","references":[{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/security/advisories/GHSA-p68j-q7hf-3qcp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55175"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f"},{"type":"PACKAGE","url":"https://github.com/spinnaker/spinnaker"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.3.4"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/rosco-2025.4.4"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.0.3"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.1.1"},{"type":"WEB","url":"https://github.com/spinnaker/spinnaker/releases/tag/rosco-2026.2.0"}],"schema_version":"1.9.0","severity":[{"score":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","type":"CVSS_V3"}],"summary":"Spinnaker: Improper yaml processing on kustomize bake operations"}